MalwarePublished 16 Jun 2026

Ransomware gang abuses Microsoft Teams relays to hide malicious traffic

Source Bleeping Computer

Description

DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure. [...]

Impact

The threat enables attackers to hide command-and-control traffic within legitimate Microsoft Teams relay infrastructure, complicating detection by security tools. The attackers achieved kernel-level privileges to disable security products and maintain persistence. The malware facilitates extensive reconnaissance, credential theft, and network scanning, leading to data exfiltration and deployment of DragonForce ransomware, resulting in system encryption and operational disruption. The use of legitimate infrastructure for C2 communications increases the difficulty of identifying malicious activity, potentially prolonging attacker dwell time.

Defensive guidance

Defenders should monitor for indicators of compromise published by Symantec related to Backdoor.Turn and DragonForce activity. Network defenders should be aware of potential abuse of Microsoft Teams TURN relay infrastructure for C2 traffic. Employ detection rules targeting anomalous use of Teams TURN tokens and relay connections. Investigate and remediate vulnerable drivers exploited for privilege escalation. Since this technique abuses legitimate Microsoft infrastructure, enhanced monitoring of Teams traffic and endpoint behavior is recommended.

References

bleepingcomputer.com/news/security/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jun 2026, 10:30 UTC

References

Community reviews

Related threats